Product Security & Vulnerability Disclosure Policy

1. Introduction

At ATESS, product security is an essential part of our commitment to delivering safe, reliable and secure energy solutions.

We take the security of our products, software, applications and connected services seriously. We recognize that security vulnerabilities may be discovered by customers, security researchers, partners or other third parties.

ATESS encourages the responsible reporting of potential security vulnerabilities and is committed to assessing, addressing and communicating such reports in a timely and transparent manner.

This policy describes how to report a potential security vulnerability to ATESS and how we manage vulnerability reports.

2. Scope

This policy applies to ATESS products and services, including but not limited to:

• AC Electric Vehicle (EV) Chargers.

• DC Electric Vehicle (EV) Chargers.

• Embedded firmware and software.

• ATESS mobile applications and associated software.

• Cloud platforms, backend systems and related connected services.

The policy covers security vulnerabilities that may affect the confidentiality, integrity or availability of ATESS products and services.

3. How to Report a Vulnerability

If you discover a potential security vulnerability affecting an ATESS product or service, please report it to our Product Security Team.

Security Contact:

Email: support@atesspower.com

Subject: Vulnerability Report – [Product / Issue]

Please include as much of the following information as possible:

• Product name and model number.

• Firmware or software version.

• Description of the identified vulnerability.

• Steps to reproduce the issue.

• Potential security impact.

• Supporting evidence, such as screenshots, logs or proof-of-concept information.

• Your contact details for further communication.

Please do not include sensitive personal information, passwords or confidential customer data in your initial report.

If you have sensitive technical information to share, please contact us to arrange a secure communication method.

4. Our Response and Handling Process

ATESS is committed to handling vulnerability reports responsibly and keeping reporters informed throughout the process.

Our standard response timelines are as follows:

These timelines represent our standard targets. Complex vulnerabilities involving hardware, third-party components or coordinated remediation may require additional time.

We will communicate relevant progress and, where appropriate, provide information about available mitigations, firmware updates or other corrective actions.

5. Coordinated Vulnerability Disclosure

ATESS supports Coordinated Vulnerability Disclosure (CVD).

We ask security researchers and reporters to:

• Report vulnerabilities directly to ATESS before making them publicly available.

• Allow ATESS reasonable time to investigate and address the reported issue.

• Avoid exploiting vulnerabilities beyond what is necessary to verify the issue.

• Avoid accessing, modifying, deleting or disclosing other people's data.

• Maintain confidentiality regarding the vulnerability until a coordinated disclosure is agreed.

ATESS will work with the reporter, relevant suppliers and other affected parties, where necessary, to coordinate investigation and remediation.

6. Responsible Security Research

ATESS welcomes good-faith security research conducted in a responsible manner.

Security testing must not disrupt our services, compromise customer data, affect the operation of products in use or cause damage to ATESS systems or third-party infrastructure.

If you accidentally encounter sensitive information or affect a system outside the intended testing scope, please stop testing and notify us immediately.

7. Product Security Support Period

ATESS is committed to maintaining the security of its products throughout their defined security support periods.

For each applicable product, ATESS defines and publishes a minimum period during which security updates will be provided to address identified vulnerabilities and maintain product security.

The security support period is determined based on the product's design, software architecture, component availability and expected product lifecycle.

Security Support Commitment

• ATESS will provide security updates for applicable products throughout their published security support periods.

• Security vulnerabilities identified during the support period will be assessed and addressed according to their severity and potential impact.

• Security updates may include firmware patches, software updates or other appropriate corrective measures.

• Security updates may be provided independently of feature updates.

• ATESS will communicate relevant security information and recommended actions to affected customers where necessary.

Support Period Information

The defined security support period for each applicable product model, including its start and end dates, is publicly available on the ATESS official website.

Product Security Support Periods:

The published support period specifically refers to the provision of security updates. It is separate from the product warranty period and does not constitute a commitment to provide new features or functionality upgrades.

8. End of Security Support

When a product reaches the end of its defined security support period, ATESS will provide relevant information regarding the end of security support.

Customers are advised to review the published support status of their products and follow ATESS security recommendations.

After the defined support period has ended, ATESS may continue to assess reported vulnerabilities and provide security updates where reasonably practicable. However, the provision of security updates beyond the published support period is not guaranteed.

Where continued use of an unsupported product may present security risks, ATESS recommends that customers consider appropriate risk mitigation measures or replacement with a supported product.

9. Contact

For questions regarding product security, security support periods or to report a potential security vulnerability, please contact:

ATESS Product Security Team

Email: support@atesspower.com

Website: https://www.atesspower.com/

ATESS welcomes responsible vulnerability reports and is committed to continuously improving the security of its products and services.